Anonymity set
>i2p's weakest link is its tiny userbase and just having it installed and running on your system fingerprints you to some degree by your isp.
>it's not really a viable alternative to tor until there's widespread adoption which isn't happening anytime soon partly because their developers are cockmonglers
>Mainly just the fact that I2P's anonymity set is much smaller than Tor's. With Tor, you have [bold: well over 2,000,000 daily users] (https://metrics.torproject.org/userstats-relay-country.html) to blend in with, likely from more walks of life due to its relative ease of use. I2P, on the other hand, only has users in the tens of thousands.
>https://metrics.torproject.org/userstats-relay-country.html
>http://hctxrvjzfpvmzh2jllqhgvvkoepxb4kfzdjm6h7egcwlumggtktiftid.onion/userstats-relay-country.html
"I'm anonymous, among the 5000 people living in this particular small town of the world."
Random observer can deanonymize]
I2P's tradeoff is the node gets cover traffic, in exchange the IP address must be publicly listed and its status can be tracked. (I know of hidden mode but it's not perfectly hidden and it removes cover traffic.) Let's say the node has a power outage or internet downtime. Eepsite, IRC, torrent client go down at the same time as an I2P node. Or it could be the user naively restarting the node for an update. These are public events that allow I2P addresses and IPs to be connected by anyone. There's also the router ID that never changes and links different IP addresses.
>I2P's anonymization is based on the attacker not being able to link tunnels and routers together. If I'm a floodfill router and I see a tunnel request a leaseset for an eepsite destination I can infer that whoever owns that tunnel is visiting that site. And if I'm able to trace it back to an i2p router then I can infer that the person running that router just visited that site.
Web cookie
Eepsites can track you by your node's static HTTP proxy address sent in the X-I2p-Destb32 header which only changes on node restart, it's the same across browser resets and across different browsers. All your browsing and accounts can be linked. It's trivial to log for the web server, no modified node required. I assume this address, once sent to an eepsite, can be queried until the client's node is shut down, to link it to an IP address.
Torrent fingerprint
Combination of torrents in a client is unique and public. You're fooling nobody by rotating torrent client identities if the torrent list before and after is similar.
Global observer
I2P and Tor don't protect against a global passive or active observer, which existed 10 years ago and exists today.
In addition we should assume glownoobs can get most I2P private keys:
>I'm a huge believer that self-hosting also means running it on hardware you control. If you run a P2P node on some VPS and think you're contributing to decentralization, you're a fool.
>Finally, nothing private about a VPS: I have to assume data centers are crawling with spooks, and I have to assume they can not only tap the lines, but scan the RAM for any keys too. So they know the router identity and what destinations it has. When you host a P2P node on a VPS, you're basically gifting those spooks a node they can use to spy on the network, or even disrupt it, rent free I might add, while you pay for it like a cuck.
They can passively monitor to detect end-to-end patterns, actively dump data into an I2P address to create a traffic shitoko they can black out shitoko node IP addresses for a few minutes to see what eepsite goes down. If there's a download bandwidth limit set in I2PSnark, it can result in huge, regular bandwidth shitoko Glownoobs have all the data they need, it's a matter of sorting through it which gets easier as they get better and the network doesn't grow.
Random active attacker
Sybil attack. There are no guard nodes and no directory jannies like Tor. Get one bad tunnel out of thousands and it's over. There are effectively only a few thousand routers, the high bandwidth X and P ones that almost all tunnels are built through. Apparently there were crash packets at one point, these could create a bad shutdown on demand for a correlation attack:
>I2P does profile which routers accept or decline tunnels. And since it builds tunnels through the routers that decline the least, in practice almost all the traffic goes through the high bandwidth X class routers.
Easy for glownoobs, or anyone with cash, to create and maintain few hundred X routers. There is already the Chinese botnet and routers running on different ports of the same IP addresses.
Team
Development is dead, there's nothing novel, nobody works on the serious issues above.
Java BLM team randomly blocked Tor without a good reason:
>>What's Tor got to do with it? Can't they send bad packets without Tor.
>Yes. That's part of why blocking tor is not a very good idea. That and the collateral damage of banning people who provide bandwidth to both tor and i2p at the same time.
Old dev 2023 beef with current zogbot team:
>Hello guys,
>
>My real name is Zlatin Balevsky, I have a LinkedIn account and my Twitter is "zlatinb". I'm generally not that interesting person but I was a contributor the I2P project for about 10 years. I resigned for some not so interesting reasons. But I just came back very briefly a few days ago and oh boy was there some serious BULLSHIT going on behind the scenes there. If you want to find out what that is, read on:
>
>Some background:
>
>There are two major implementations of I2P - a Java one (https://geti2p.net) and a C++ one (https://i2pd.website). Since I know Java, I was contributing to the Java one. However, after what I saw the last few days, I say STAY THE FUCK AWAY from that one. Seriously, use the C++ one. It is more rough around the edges but if you care at all about actually being safe and private use that and do not look back.
>
>So, there is an IRC network inside I2P known as Irc2P. In fact, that's where pretty much all the action is. I'm going to paste some chat logs from the #i2p-dev channel inside the Irc2P network. If you want to verify that I'm not bullshitting you, they are also available at http://major.i2p/irc2p/i2p-dev/2023/01/18 (but you need to be running an I2P software to access this site.)
>i2p's weakest link is its tiny userbase and just having it installed and running on your system fingerprints you to some degree by your isp.
>it's not really a viable alternative to tor until there's widespread adoption which isn't happening anytime soon partly because their developers are cockmonglers
>Mainly just the fact that I2P's anonymity set is much smaller than Tor's. With Tor, you have [bold: well over 2,000,000 daily users] (https://metrics.torproject.org/userstats-relay-country.html) to blend in with, likely from more walks of life due to its relative ease of use. I2P, on the other hand, only has users in the tens of thousands.
>https://metrics.torproject.org/userstats-relay-country.html
>http://hctxrvjzfpvmzh2jllqhgvvkoepxb4kfzdjm6h7egcwlumggtktiftid.onion/userstats-relay-country.html
"I'm anonymous, among the 5000 people living in this particular small town of the world."
Random observer can deanonymize]
I2P's tradeoff is the node gets cover traffic, in exchange the IP address must be publicly listed and its status can be tracked. (I know of hidden mode but it's not perfectly hidden and it removes cover traffic.) Let's say the node has a power outage or internet downtime. Eepsite, IRC, torrent client go down at the same time as an I2P node. Or it could be the user naively restarting the node for an update. These are public events that allow I2P addresses and IPs to be connected by anyone. There's also the router ID that never changes and links different IP addresses.
>I2P's anonymization is based on the attacker not being able to link tunnels and routers together. If I'm a floodfill router and I see a tunnel request a leaseset for an eepsite destination I can infer that whoever owns that tunnel is visiting that site. And if I'm able to trace it back to an i2p router then I can infer that the person running that router just visited that site.
Web cookie
Eepsites can track you by your node's static HTTP proxy address sent in the X-I2p-Destb32 header which only changes on node restart, it's the same across browser resets and across different browsers. All your browsing and accounts can be linked. It's trivial to log for the web server, no modified node required. I assume this address, once sent to an eepsite, can be queried until the client's node is shut down, to link it to an IP address.
Torrent fingerprint
Combination of torrents in a client is unique and public. You're fooling nobody by rotating torrent client identities if the torrent list before and after is similar.
Global observer
I2P and Tor don't protect against a global passive or active observer, which existed 10 years ago and exists today.
In addition we should assume glownoobs can get most I2P private keys:
>I'm a huge believer that self-hosting also means running it on hardware you control. If you run a P2P node on some VPS and think you're contributing to decentralization, you're a fool.
>Finally, nothing private about a VPS: I have to assume data centers are crawling with spooks, and I have to assume they can not only tap the lines, but scan the RAM for any keys too. So they know the router identity and what destinations it has. When you host a P2P node on a VPS, you're basically gifting those spooks a node they can use to spy on the network, or even disrupt it, rent free I might add, while you pay for it like a cuck.
They can passively monitor to detect end-to-end patterns, actively dump data into an I2P address to create a traffic shitoko they can black out shitoko node IP addresses for a few minutes to see what eepsite goes down. If there's a download bandwidth limit set in I2PSnark, it can result in huge, regular bandwidth shitoko Glownoobs have all the data they need, it's a matter of sorting through it which gets easier as they get better and the network doesn't grow.
Random active attacker
Sybil attack. There are no guard nodes and no directory jannies like Tor. Get one bad tunnel out of thousands and it's over. There are effectively only a few thousand routers, the high bandwidth X and P ones that almost all tunnels are built through. Apparently there were crash packets at one point, these could create a bad shutdown on demand for a correlation attack:
>I2P does profile which routers accept or decline tunnels. And since it builds tunnels through the routers that decline the least, in practice almost all the traffic goes through the high bandwidth X class routers.
Easy for glownoobs, or anyone with cash, to create and maintain few hundred X routers. There is already the Chinese botnet and routers running on different ports of the same IP addresses.
Team
Development is dead, there's nothing novel, nobody works on the serious issues above.
Java BLM team randomly blocked Tor without a good reason:
>>What's Tor got to do with it? Can't they send bad packets without Tor.
>Yes. That's part of why blocking tor is not a very good idea. That and the collateral damage of banning people who provide bandwidth to both tor and i2p at the same time.
Old dev 2023 beef with current zogbot team:
>Hello guys,
>
>My real name is Zlatin Balevsky, I have a LinkedIn account and my Twitter is "zlatinb". I'm generally not that interesting person but I was a contributor the I2P project for about 10 years. I resigned for some not so interesting reasons. But I just came back very briefly a few days ago and oh boy was there some serious BULLSHIT going on behind the scenes there. If you want to find out what that is, read on:
>
>Some background:
>
>There are two major implementations of I2P - a Java one (https://geti2p.net) and a C++ one (https://i2pd.website). Since I know Java, I was contributing to the Java one. However, after what I saw the last few days, I say STAY THE FUCK AWAY from that one. Seriously, use the C++ one. It is more rough around the edges but if you care at all about actually being safe and private use that and do not look back.
>
>So, there is an IRC network inside I2P known as Irc2P. In fact, that's where pretty much all the action is. I'm going to paste some chat logs from the #i2p-dev channel inside the Irc2P network. If you want to verify that I'm not bullshitting you, they are also available at http://major.i2p/irc2p/i2p-dev/2023/01/18 (but you need to be running an I2P software to access this site.)
